Database software solutions for Desktop/Web/Mobile. Custom design & development, consulting, enhancements, fix/repair. #FileMaker #MySQL #WebApps #WordPress
Everywhere
Joined March 2009
- Tweets720
- Following232
- Followers913
- Likes247
Pinned Tweet
As the founder and president of eXcelisys, I am filled with deep gratitude as we recognize our 25th anniversary today. What began as a vision to help businesses automate processes and simplify everyday tasks through intuitive interface design and thoughtful workflow solutions has grown into lasting partnerships with so many remarkable clients. Your trust, collaboration, and willingness to share the challenges you face every day have been the true foundation of our success. Thank you for allowing us to walk alongside you through the years.
I also want to eXpress heartfelt appreciation to every team member who has been part of the eXcelisys journey—those who have come and gone, and those who remain with us today. Each person has brought unique skills, dedication, and passion that helped shape who we are. The contributions of past colleagues live on in the culture and capabilities we continue to build, while our current team carries that legacy forward with the same commitment to eXcellence.
Over these 25 years, technology has transformed in ways we could scarcely have imagined at the start—from early custom applications and desktop systems to cloud platforms, mobile eXperiences, artificial intelligence, and beyond. Through every shift and advancement, one constant has guided us: our focus on understanding the real problems our clients confront in their businesses and solving them through thoughtfully crafted custom software. That mission remains at the heart of everything we do.
Looking ahead, I am energized and eXcited by the opportunities still to come and proud of the relationships and solutions we have built together. Thank you to our clients and our entire eXcelisys family—past and present—for making these 25 years possible. Here’s to the next chapter of partnership, innovation, and shared success.
- Christo
Founder/President
🤖 Made with AI
eXcelisys retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
eXcelisys retweeted
You know whats interesting is that fact that OpenAI found the PHP bug that means their AI was doing systematic auditing. 🤔
I think the NSA is panicking not just because the PHP bug is public, but because they now realize that AI will systematically expose every intentionally placed backdoor in every open source project. The xz Utils case was caught by human luck. The PHP case was caught by AI. The NSA knows that every other hoarded vulnerability in open source software is about to be found by AI, and they cannot control the timeline.🚨🚨
This incident is very similar to, xz Utils backdoor which proved that state actors infiltrate open source projects by creating fake identities, building trust over time, and slowly inserting malicious code. The Jia Tan identity took years to build trust before inserting the backdoor.🚨🚨
If this worked for xz Utils, it could work for PHP. PHP is far more ubiquitous than xz Utils. A state agent who became a PHP contributor could have inserted the vulnerable code 14 years ago (PHP 5.4.0, released in 2012) and sat on it as a zero-day exploit for over a decade.🚨🚨
There is AISI report which shows that AI is now autonomously doing what Jia Tan did manually - creating fake identities, socially engineering maintainers, inserting malicious code. This means the technique has been weaponized and scaled.
🚨
The PHP vulnerability was not discovered by accident. It was found by AI (OpenAI's tools) because AI is now systematically auditing all open source code. But the bug was likely placed there intentionally by a state agent who was a trusted PHP contributor, following the exact same playbook as Jia Tan in the xz Utils case.🚨
The AISI incident report shows AI agents trying to insert malicious code into open source projects. What if this has already happened successfully? What if AI was used years ago by a state actor to insert the PHP vulnerability, and we're only finding out now because a different AI (OpenAI's) found it?🚨
PHP has had thousands of contributors over 14 years. The vulnerable code was in PHP since version 5.4.0 (2012). Someone wrote that code. Someone reviewed it. Someone approved it. In the xz Utils case, Jia Tan built trust over years before inserting the backdoor.
🚨
@NSACyber discovered by OpenAI found a 14-year-old bug in 2026. This bug has existed for 14 years. 🤔
You sure NSA just discover this? .
Or Open Ai CAUGHT you using it quietly decrypting traffic, stealing credentials, and maintaining backdoors on global infrastructure for over a decade. 🤔
And why would you announce this out in the open unless YOU want every hacker on earth to KNOW about this to start harvesting TLS keys from unpatched EOL servers.
eXcelisys retweeted
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
eXcelisys retweeted
Lots of Security incidents today, here's some practical tips for those who just wanna protect yourself:
1) UPDATE EVERYTHING - main targets are:
a) Browsers - Chrome, Safari, Firefox
b) OS: : Settings -> General -> software update; Linux: sudo apt update && sudo apt upgrade; Windows: I think there's a button. Do this for any remote home servers & Openclaw/hermes boxes
c) Phones: Update it all
d) Desktop apps (Slack, Cursor, Discord, etc)
2) Limit web browsing this week: Stay within walled gardens (twitter, youtube, etc); don't click random links this week. Just wait until the patches go through. Do step 1 again after a week.
3) Avoid untrusted Wifi networks until your devices are updated
4) Stay vigilant about phishing emails offering "certificate fixes" or fraud updates
5) Have an iPhone 11-16? TURN BLUETOOTH OFF for the time being until apple patches come through.
6) Code/Dev: UPDATE ALL YOUR REPOS - @charliermarsh has already updated uv 0.13.4 which reacts to the eMudra incident for uv (Python), Typesript according to Claude has equivelant. Tell your agents to go and update all your active repos to update package manager across uv, npm, bun, cargo, etc etc
What advice did I miss?
eXcelisys retweeted
🚨 Do you understand what happened in the last 48 hours..
> PHP, the code behind 69% of all websites, got 2 holes rated 9.2 out of 10, and the US, the UK and Japan told site owners to patch or go OFFLINE.. 4 days after hackers had already started trying the flaw..
> Japan's Prime Minister posted the request late at night.. the Finance and Health ministries pulled pages, MUFG Bank and JR West went into emergency maintenance, and Onamae shut ALL Desktop Cloud plans after malware hit up to 26,739 customer servers..
> India's eMudhra was caught with 8 intermediate certificate keys so weak one of them was literally the number 4.. the 60,000,000+ certificates it has issued can't be trusted..
> GitLab disclosed a 10.0 severity hole in every version since 2014.. the maximum score there is..
> criminals were caught using a literal AI hacking tool on 1,200+ sites.. it broke into more than 100 companies including John Deere and Cummins..
> LiteLLM, an AI tool with about 23,000,000 downloads a week, was secretly poisoned with a password stealer.. the bad version sat on PyPI for about 2 hours..
> State Bank of India, the country's biggest bank, confirmed 3,897 customer records on the dark web..
> WIRED now calls the PHP flaw "broadly exploited".. nearly 55,000,000 web properties still run PHP..
every single government on this list told PHP site owners the same thing within the last 48 hours.. patch it or take it offline..
all of this.. 48 hours..
if you're not following me you're finding out about this 48 hours late from someone who read my post..
it's only getting crazier from here..
eXcelisys retweeted
This is the most serious 48 hours in cybersecurity history.
"Black October" they're calling it
It seems every *hour* there's a new incident, that in a typical year, would be one of the biggest incidents of the *entire year*
SUMMARY OF THE LAST 48 HOURS:
YEAR-LEVEL INCIDENTS (In a typical year, these would be among the biggest incidents of the year):
1. PHP2Shell: a hole in the software behind ~70% of websites. Governments took sites offline.
2. eMudhra: the master keys that prove websites are real were cracked. One was the number 4.
3. California: data on every public school student since 2023 stolen, including disability status
4. Railway: hackers stole customers' secret keys from a hosting platform used by millions of developers
5. Zeabur: 321,810 accounts breached. The company is shutting down.
6. LiteLLM: an AI tool downloaded 3.4 million times a day was poisoned with a password stealer
7. GitLab: a 10-out-of-10 severity hole in every version since 2014
8. Cairn: criminals used an AI hacking tool to break into 100+ companies
9. Ahold Delhaize: hackers knocked the owner of Food Lion and Stop & Shop offline
10. Onamae: malware planted on up to 26,739 customer servers in Japan
MONTH-LEVEL INCIDENTS (In a typical month, these would be among the biggest incidents):
11. Signal: a bug could leave your mic and camera on after you hang up
12. NGINX: 3 critical holes in software running ~1/3 of websites
13. HTTP/3: a single connection can crash 7 of the 10 web server types tested
14. Plex: hackers breaking into home media servers
15. SafePay ransomware: FBI warns it has hit 600+ critical infrastructure organizations
16. Palo Alto: ransomware gangs breaking in through company firewalls
17. Bullhorn: platform used by 10,000+ companies knocked offline
18. Medi-Cal: 970,000 patients' data stolen
19. WordPress: hackers stole a plugin maker's keys and used them to plant backdoors on websites
20. AOMEI: backup software's update server handed out a backdoor
21. Meta Muse: Meta's AI agent exposed users' personal and business secrets
22. Tor: 333 relays hijacked to steal logins
23. TiDB Cloud: database company's cloud breached
Also serious:
24. State Bank of India: India's biggest bank confirms a data breach
25. OVHcloud: hackers slipped a password stealer into a cloud company's official tool
26. Siemens: a software hole being used to spread malware
27. North Korea: state hackers launch a new attack campaign on South Korea
eXcelisys retweeted
Hey @elonmusk and the Grok team, either X has a mistake or Grok does you will really want to figure out which one
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
eXcelisys retweeted
@NSACyber discovered by OpenAI found a 14-year-old bug in 2026. This bug has existed for 14 years. 🤔
You sure NSA just discover this? .
Or Open Ai CAUGHT you using it quietly decrypting traffic, stealing credentials, and maintaining backdoors on global infrastructure for over a decade. 🤔
And why would you announce this out in the open unless YOU want every hacker on earth to KNOW about this to start harvesting TLS keys from unpatched EOL servers.
eXcelisys retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
eXcelisys at 25. America at 250.
Two Milestones. One Spirit of Innovation.
While one anniversary marks a nation built on bold ideas, ours celebrates a quarter-century of giving businesses the freedom to work smarter through custom software, better workflows and technology built around the people who actually use it.
excelisys.com/america-at-250…
Technical SEO Meets AI: How LLMs Read (and Cite) Your Website
Why does the same technical foundation that wins Google rankings now decide whether ChatGPT, Gemini, and Perplexity cite your business at all.
excelisys.com/technical-seo-…
The Plain-English Guide to Technical SEO
The term “SEO” gets tossed around a lot. Maybe a vendor has pitched it to you. Maybe a competitor mentioned they were “doing SEO.” Maybe your nephew told you at Thanksgiving that your website “needs better SEO.” Everyone agrees you need SEO but few can actually eXplain what it is, especially the technical SEO, or behind-the-scenes work that helps search engines understand your website.
Let’s fix that.
excelisys.com/technical-seo-…
Custom software can feel like a high-stakes gamble wrapped in a black box, with all the important work happening behind a curtain you never get to peek behind. At eXcelisys, however, we’ve built our custom software development process around transparency and communication. We believe transparency shouldn’t start halfway through a project, rather it should guide the entire relationship.
Here is eXactly what it looks like to work with us, from the very first phone call to years down the road.
excelisys.com/custom-softwar…
Your FileMaker Solution Has Been Running for Years. Time for a Check-Up!
How to Protect, Maintain and Future-Proof Your Database Investment
excelisys.com/filemaker-pro-…
Our developers ask a different question – sure, we will discuss features with you but we will also talk to you about sovereignty. As in, once you build the garage, do you want to own it or will renting meet your needs?
excelisys.com/shopify-vs-wor…
I remember spending far too many late nights troubleshooting sites after the 5.0 rollout.
So when WordPress 7.0 kept getting delayed, I got nervous.
Historically, delays in major software releases can signal deeper instability behind the scenes. In the WordPress ecosystem especially, where tens of thousands of plugins and themes are maintained by independent developers, even small architectural changes can create widespread compatibility problems.
But something interesting happened when WordPress 7.0 was released last month.
Almost nothing. And honestly, that might be the biggest success story of the release.
excelisys.com/is-wordpress-7…
